TKGI versions bundling uaa-release v79.x.x no longer support wildcard/subdomain matching for cluster_client redirect URIs by default, breaking OIDC login for any application using TKGI's UAA client

Products

• VMware Tanzu Kubernetes Grid Integrated Edition
• VMware Tanzu Kubernetes Grid Integrated Edition (Core)
• VMware Tanzu Kubernetes Grid Integrated EditionStarter Pack (Core)

Issue/Introduction

After upgrading to a TKGI version that bundles uaa-release v79.x.x (TKGI v1.26 and TKGI 1.25.3 that picked up the same uaa-release line), OIDC login starts failing for any application/URL registered under the "TKGI cluster client redirect URIs" field.

The cluster_client OAuth2 client in UAA rejects the redirect back from the client application even though the registered redirect URI "looks" correct, because it no longer matches subdomains/paths under the registered value.

Environment

Tanzu Kubernetes Grid Integrated

Cause

Redirect URI validation is governed by a UAA job-spec property, uaa.client.redirect_uri.matching_mode, which supports:

• legacy — unsafe/implicit matching (e.g., https://example.com also matches all subdomains and paths under it).
• exact — RFC 6749–compliant strict string matching, with no wildcard/subdomain support.

Starting with uaa-release v79.x.x, the default for this property changed from legacy to exact as observed here https://github.com/cloudfoundry/uaa-release/issues/1230

Because this uaa-release version was picked up across multiple TKGI lines,  this is a silent breaking change for any environment that depended on wildcard patterns in the TKGI cluster client redirect URIs field, regardless of which application is behind that redirect URI.

Resolution

Before applying, confirm which uaa-release version is bundled in your TKGI tile version — this issue affects any TKGI release line (1.25.x or 1.26.x) that bundles uaa-release v79.0.0 or later.

Workaround: To fix this temporarily we can update the uaa config file in the TKGI API VM following the below steps:

1) ssh to the PKS/TKGI API VM 

bosh -d pivotal-container-service-uuid ssh pivotal-container-service/id

2) Edit the uaa config file and update the property  uaa.oauth.redirect_uri.allow_unsafe_matching to true

vi /var/vcap/jobs/uaa/config/uaa.yml

sample snippet:

uaa:
  shutdown:
    sleep: 5000
  url: https://tkgi-api-url:8443
  limitedFunctionality:
    statusFile: "/var/vcap/data/uaa/bbr_limited_mode.lock"
    whitelist:
      endpoints:
      - "/oauth/authorize/**"
      - "/oauth/token/**"
      - "/check_token/**"
      - "/login/**"
      - "/login.do"
      - "/logout/**"
      - "/logout.do"
      - "/saml/**"
      - "/autologin/**"
      - "/authenticate/**"
      - "/idp_discovery/**"
      methods:
      - GET
      - HEAD
      - OPTIONS
  oauth:
    redirect_uri:
      allow_unsafe_matching: true

This restores wildcard/subdomain redirect URI matching for all redirect URIs registered on the cluster_client and resolves the login failures immediately.

 

Important caveat: This is a manual edit to a BOSH-rendered file. It is not persistent — the setting will be overwritten on the next bosh deploy/tile upgrade/VM recreation because it is not backed by a manifest property or tile form field. Treat this as an interim/emergency workaround only, and re-apply after any TKGI upgrade or bosh recreate until a supported, persistent option is available.  

In the upcoming releases of TKGI a fix will be implemented to accommodate the change in UAA job properties to support wildcard characters. 

Watchout for the Official TKGI Release Notes which will be updated once the fix is implemented.